The vulnerability allows attackers to repeatedly request and test 6‑digit SMS/email verification codes without any server‑side limit on attempts. Because the codes never expire or are invalidated, unauthenticated users can brute force them to reset passwords or bypass login. This leads to full control over the victim’s account, enabling data theft, privilege escalation within the system, and potential compromise of other services linked to the account. The weakness is an example of improper restriction of authentication attempts (CWE‑307).

The flaw affects the course‑tencent‑cloud application developed by xiaochong0302, up to and including release version 2.0.1. Users running any version of the application prior to a fixed release are vulnerable unless the affected code paths have been patched or removed by the vendor.

The base CVSS score of 9.1 indicates a high severity and the lack of an EPSS score leaves the exact exploitation probability uncertain, though the attack vector is straightforward: an attacker who knows a target’s phone number or email can repeatedly rotate source IP addresses to request new verification codes through the password reset and login endpoints. The bug is not listed in the CISA KEV catalog, but its high score and clear exploitability make it a near‑shooter threat for organizations using the affected application.